CVE-2021-31522

Kylin can receive user input and load any class through Class.forName.... This issue affects Apache Kylin 2 version 2.6.6 and prior versions; Apache Kylin 3 version 3.1.2 and prior versions; Apache Kylin 4 version 4.0.0 and prior versions...

Design/Logic Flaw

Kylin can receive user input and load any class through Class.forName.... This issue affects Apache Kylin 2 version 2.6.6 and prior versions; Apache Kylin 3 version 3.1.2 and prior versions; Apache Kylin 4 version 4.0.0 and prior versions...

CVE-2021-31522

Kylin can receive user input and load any class through Class.forName.... This issue affects Apache Kylin 2 version 2.6.6 and prior versions; Apache Kylin 3 version 3.1.2 and prior versions; Apache Kylin 4 version 4.0.0 and prior versions...

CVE-2021-31522 Apache Kylin unsafe class loading

Kylin can receive user input and load any class through Class.forName.... This issue affects Apache Kylin 2 version 2.6.6 and prior versions; Apache Kylin 3 version 3.1.2 and prior versions; Apache Kylin 4 version 4.0.0 and prior versions...

CVE-2021-31522

CVE-2021-31522 affects Apache Kylin: Kylin can receive user input and load arbitrary classes via Class.forName(...). Affected are Kylin 2.x (2.6.6 and earlier), 3.x (3.1.2 and earlier), and 4.x (4.0.0 and earlier). Root cause is unsafe dynamic class loading triggered by user input, exposing poten...

PT-2022-1948

Name of the Vulnerable Software and Affected Versions WPS Presentation version 11.8.0.5745 Description The issue is related to the insecure loading of the d3dx9 41.dll library when opening .pps files, specifically due to 'current directory type' DLL loading. This can allow an attacker to elevate...

Apache Kylin input validation error vulnerability

Apache Kylin is an open source distributed analytic data warehouse from the Apache Foundation. The product mainly provides SQL query interface on top of Hadoop/Spark and multi-dimensional analysis OLAP and other functions. Apache kylin has an input validation error vulnerability, which stems from...

PT-2022-1946

Name of the Vulnerable Software and Affected Versions WPS Office version 10.8.0.6186 Description The issue is related to the insecure loading of dynamic link libraries DLLs, such as VERSION.DLL, by the installer of WPS Office. This allows an attacker to execute arbitrary code with the privilege o...

CVE-2021-31522: Use of Externally-Controlled Input to Select Classes or Code

Kylin can receive user input and load any class through Class.forName.... This issue affects Apache Kylin 2 version 2.6.6 and prior versions; Apache Kylin 3 version 3.1.2 and prior versions; Apache Kylin 4 version 4.0.0 and prior versions...

Dashboard is not working , lend positiona are still loading, the same is for Lend button, Lend Amount to lend is not refresjing

Handle 0v3rf10w Vulnerability details Impact Detailed description of the impact of this finding. Proof of Concept Provide direct links to all referenced code in GitHub. Add screenshots, logs, or any other relevant proof that illustrates the concept. Tools Used Recommended Mitigation Steps --- The...

PT-2022-4823

Name of the Vulnerable Software and Affected Versions Blender versions prior to 2.83.19 Blender versions prior to 2.93.8 Blender versions prior to 3.1 Description An integer overflow in the processing of loaded 2D images leads to a write-what-where vulnerability and an out-of-bounds read...

Google Chrome Bypass Security Restrictions

The vulnerability of Google Chrome’s browser loading function exists due to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to bypass existing security restrictions remotely...

Google Chrome Background Loading Bypass Content Security Policy Unauthorized Access

The vulnerability of the Google Chrome browser’s background loading function is related to privilege management errors. Exploiting this vulnerability could allow a remote attacker to bypass content security policies and gain unauthorized access to protected information...

freetype2:type42-render: Use-of-uninitialized-value in TT_Load_Simple_Glyph

Detailed Report: https://oss-fuzz.com/testcase?key=5254848029786112 Project: freetype2 Fuzzing Engine: libFuzzer Fuzz Target: type42-render Job Type: libfuzzermsanfreetype2 Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: TTLoadSimpleGlyph loadtruetypeglyph...

ghostscript:gstoraster_fuzzer: Crash in pdfi_read_cff_font

Detailed Report: https://oss-fuzz.com/testcase?key=5076659332579328 Project: ghostscript Fuzzing Engine: libFuzzer Fuzz Target: gstorasterfuzzer Job Type: libfuzzerasanghostscript Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x63110006dadf Crash State: pdfireadcfffont pdfiloadfont...

SonicWall Email Security File Check Unauthorized Access

The vulnerability of SonicWall Email Security and SonicWall Hosted Email Security software lies in insufficient file checking during the loading process. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information by downloading a malicious ZIP archive...

Laravel Code Execution

The vulnerability of the PHP framework Laravel is related to the unlimited loading of dangerous files. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

Security update for python-Babel (important)

openSUSE Security Update: Security update for python-Babel Announcement ID: openSUSE-SU-2021:1553-1 Rating: important References: 1185768 Cross-References: CVE-2021-42771 CVSS scores: CVE-2021-42771 SUSE: 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.2 An...

Code injection via unsafe YAML loading

Impact Sockeye uses YAML to store model and data configurations on disk. Versions below 2.3.24 use unsafe YAML loading, which can be made to execute arbitrary code embedded in config files. An attacker can add malicious code to the config file of a trained model and attempt to convince users to...

Remote Code Execution (RCE)

sockeye is vulnerable to remote code execution. The use of insecure loading of yaml for the model configuration files allows an attacker to execute arbitrary code embedded in config files...